REMARKS 

The claims of the present application have been amended to include subject matter clearly 
disclosed in the originally filed specification. No new matter has been added. 

In the event a telephone conversation would expedite the prosecution of this application, the 
Examiner may reach the undersigned at (408) 505-5 100. For payment of the fees due in connection 
with the filing of this paper, the Commissioner is authorized to charge such fees to Deposit Account 
No. 50-1351 (Order No. XACTP014C). A duplicate copy of the transmittal is enclosed for this 
purpose. ^ 
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APPENDIX A 



47. (Amended) [A method for reporting on the collection of network usage information 
from a plurality of network devices] A method for database management and recovery, the method 
comprising: 

(a) collecting network communications usage information in real-time from network devices at a 
plurality of layers utilizing multiple gatherers each including a plurality of information source 
modules each interfacing with one of the network devices and capable of communicating 
using a protocol specific to the network device coupled thereto, the network devices selected 
from the group consisting of routers, switches, firewalls, authentication servers, web hosts, 
proxy servers, netflow servers, databases, mail servers, RADIUS servers, and domain name 
servers, the gatherers being positioned on a segment of the network on which the network 
devices coupled thereto are positioned for minimizing an impact of the gatherers on the 
network; 

(b) translating the network communications usage information collected from the network 
devices utilizing the information source modules; 

(c) caching the network communications usage information collected from the network devices 
utilizing the gatherers; 

(d) normalizing the network communications usage information with the gatherers by excluding 
fields not required by a central event manager coupled to the gatherers; 

(e) defining an enhancement procedure utilizing the central event manager; 

(f) coordinating the collection of the network communications usage information by the 
gatherers utilizing the central event manager; 

(g) filtering the network communications usage information utilizing the central event manager; 

(h) completing a plurality of data records from the filtered network communications usage 
information, the plurality of data records corresponding to network usage by a plurality of 
users; 

(0 aggregating the network communications usage information and the data records utilizing the 
central event manager for reducing a number of the data records; 
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(j) enhancing the aggregation with the gatherers in accordance with the defined enhancement 
procedure; 

(k) time stamping the data records at a user-specified interval; 

(1) storing the time stamped data records in tables in a central database coupled to the central 

event manager at a user- specified interval; [and] 
(m) deleting the stored data records upon the cessation of a predetermined amount of time after 

the storage utilizing the timestamp; 
(n) continuously monitoring a state of the gatherers; 
(o) detecting a fault; and 

(p) utilizing the state of the gatherers and the stored data records to recover from the fault upon the 
detection thereof. 
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